Archive
January 2014
Vulnerabilities first published in this month (UTC), newest first.
558 results · Feed
-
Unscored —CVE-2013-7248 Public exploit
Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 has a hardcoded password f…
-
Unscored —
The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication an…
-
Unscored —
Cross-site scripting (XSS) vulnerability in clickstream.js in Y! Toolbar plugin for FireFox 3.1.0.20130813024103 for Ma…
-
Unscored —
lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary fi…
-
Unscored —
Secunia CSI Agent 6.0.0.15017 and earlier, 6.0.1.1007 and earlier, and 7.0.0.21 and earlier, when running on Red Hat Li…
-
Unscored —
The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a …
-
Unscored —CVE-2014-1671 Public exploit
Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remo…
-
Unscored —
Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via…
-
Unscored —
Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing tabl…
-
Unscored —
XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, pe…
-
Medium 6.8
GE Proficy HMI/SCADA Path Traversal
The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system. By modifying the source location, an attacker could send shell code to the CimWebServer which would deploy the nefarious files as…
-
Unscored —
The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote…
-
High 7.5
GE Proficy HMI/SCADA Path Traversal
Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Cisco Video Surveillance 5000 HD IP Dome ca…
-
Unscored —CVE-2014-1670 EPSS 14%
The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vect…
-
High —CVE-2014-1202 Public exploit
Code injection via property expansion in SoapUI
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
-
Unscored —
Almanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed, which allows local users to obtain sensitive …
-
Unscored —
The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client in…
-
Unscored —
Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) …
-
Unscored —
The libxlDomainGetNumaParameters function in the libxl driver (libxl/libxl_driver.c) in libvirt before 1.2.1 does not p…
-
Low —
Improper Authentication in Apache Hadoop
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensiti…
-
Unscored —
libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains …
-
Unscored —
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other use…
-
Unscored —
The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restr…
-
Unscored —CVE-2014-1447 Public exploit
Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to caus…
-
Unscored —
Format string vulnerability in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possi…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the token processing system (pki-tps) in Red Hat Certificate Sys…
-
Unscored —CVE-2013-7316 Public exploit
Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to injec…
-
Unscored —CVE-2013-7184 Public exploit
Gretech GOM Media Player 2.2.56.5158 and earlier allows remote attackers to cause a denial of service (memory corruptio…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary …
-
Unscored —
The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php i…
-
Unscored —
Directory traversal vulnerability in the Gapless Player SimZip (aka Simple Zip Viewer) application before 1.2.1 for And…
-
Unscored —
Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary…
-
Unscored —
Multiple SQL injection vulnerabilities in Avanset Visual CertExam Manager 3.3 and earlier allow remote authenticated us…
-
Unscored —
Directory traversal vulnerability on the Emerson Network Power Avocent MergePoint Unity 2016 (aka MPU2016) KVM switch w…
-
Unscored —
The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to discover the ad…
-
Unscored —
The Thecus NAS server N8800 with firmware 5.03.01 uses cleartext credentials for administrative authentication, which a…
-
Unscored —
The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a get_useri…
-
Unscored —
Cisco Video Surveillance Operations Manager (VSOM) does not require authentication for MySQL database connections, whic…
-
Medium —
Missing XML Validation in Spring Framework
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CS…